Anki Local HTTP Server Origin Validation Bypass

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Anki versions prior to 25.09.3, where the application launches a local HTTP server to serve media files and web pages for parts of its interface. However, requests from other origins were not sufficiently blocked, meaning a malicious website could potentially send requests to this local server. The severity of this issue varies depending on the browser's Private Network Access protections.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow a malicious website to trigger side-effecting requests to the local HTTP server that Anki runs. This could potentially lead to unintended actions or data exposure depending on the browser's security protections. The impact severity varies by browser, but it generally poses a risk of unauthorized interactions with the local server.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Anki to version 25.09.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Anki launching a local HTTP server that insufficiently blocks requests from other origins, potentially allowing malicious websites to send side-effecting requests to the local server.

To detect if this vulnerability is present on your system or network, you can check if Anki is running a local HTTP server and whether it is accessible from other origins.

One approach is to scan for open local HTTP ports that Anki might be using (commonly localhost ports). You can use commands like:

• On Linux/macOS, use: `lsof -iTCP -sTCP:LISTEN -n -P | grep anki` to identify if Anki is listening on any TCP ports.
• Use `netstat -an | grep LISTEN` or `ss -tlnp` to list listening ports and associated processes.
• You can also attempt to send HTTP requests to localhost ports to see if the Anki media server responds. For example, using curl:
• `curl -v http://localhost:<port>/` replacing <port> with the port number identified.

If the server responds and does not properly restrict cross-origin requests, it may be vulnerable.

Additionally, monitoring browser network activity for requests to localhost initiated by external websites can help detect exploitation attempts.

Useful 0 Not Useful 0